vidar | 1796560x00000000004000000[.]dmp | Triage

Sharing

General

Target

1796560x00000000004000000.dmp
Size

2.8MB
MD5

71a8d3e5a82f056fd22b1ee222561ccc
SHA1

e21623189a1c169d3755246172d57f78502b8f6d
SHA256

ac4c17341b6f1517e3d6d0da3ca5fd5d38893827e325fbd7c3b1a67e9501c2e9
SHA512

25c7592fea297974e0a7f06f763dcf7daa2bb83df9d029a7821f66d95ca3aa51b36db92acf4a00e400ffa9e9b8567b449d0e44c7d4351f5ad8db5340d9a6de55
SSDEEP

6144:uCyiXVZhMMOP/AXh/PP6IEWEonebA8mUG05UJKH2khp9j5kz+i9moRQ2Jg7Eahr/:udiXZMbKCxWIW+kmoRQ227EyiPxInr

Score

10^/10

vidar

Malware Config

Signatures

Vidar family
vidar

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1796560x00000000004000000.dmp

Files

1796560x00000000004000000.dmp
.exe windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 251KB - Virtual size: 251KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 56KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 53KB - Virtual size: 130KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 22KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ